USN-730-1: libpng vulnerabilities

Ubuntu Security Notice USN-730-1

5th March, 2009

libpng vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

Ubuntu 8.10

Ubuntu 8.04 LTS

Ubuntu 7.10

Ubuntu 6.06 LTS

Software description

libpng

Details

It was discovered that libpng did not properly perform bounds checking incertain operations. An attacker could send a specially crafted PNG image andcause a denial of service in applications linked against libpng. This issueonly affected Ubuntu 8.04 LTS. (CVE-2007-5268, CVE-2007-5269)

Tavis Ormandy discovered that libpng did not properly initialize memory. If auser or automated system were tricked into opening a crafted PNG image, anattacker could cause a denial of service via application crash, or possiblyexecute arbitrary code with the privileges of the user invoking the program.This issue did not affect Ubuntu 8.10. (CVE-2008-1382)

It was discovered that libpng did not properly NULL terminate a keywordstring. An attacker could exploit this to set arbitrary memory locations tozero. (CVE-2008-5907)

Glenn Randers-Pehrson discovered that libpng did not properly initializepointers. If a user or automated system were tricked into opening a crafted PNGfile, an attacker could cause a denial of service or possibly execute arbitrarycode with the privileges of the user invoking the program. (CVE-2009-0040)

Update instructions

The problem can be corrected by updating your system to the following
package version: